tracking: DEP0190 (shell:true + args) and bash PATH probe regressions in npx-cli bundle and hook scripts

[thedotmack]

Root Cause

Multiple spawn sites pass an args array alongside shell: true, triggering Node.js DEP0190 security deprecation on Node >=22. PR #1677 fixed this in scripts/bun-runner.js but the same pattern exists in the dist/npx-cli/index.js bundle (bun/uv/claude detection, npm install, codex spawn). Separately, hooks prepend $($SHELL -lc 'echo $PATH') which spawns a fresh login shell on every hook, failing on Windows Git Bash and causing PATH resolution errors. Both are spawn-contract failures in the distributed bundles.

Tracked Items

Issues

• Closes DEP0190 still reproducible on 13.6.1 (regression of #1503 / #438 / #433): args + shell in the npx-cli bundle #2941 — DEP0190 still reproducible on 13.6.1 (regression of #1503 / #438 / #433): args + shell in the npx-cli bundle #2941
• Closes hook error #2914 — hook error #2914

PRs

• Related PR fix: install Windows Claude Code hooks without bash #2945 — fix: install Windows Claude Code hooks without bash #2945
• Related PR fix(hooks): replace fragile $SHELL -lc PATH probe with printenv-first pattern #2598 — fix(hooks): replace fragile $SHELL -lc PATH probe with printenv-first pattern #2598

Resolution

This is the canonical tracking issue for this root cause. Individual issues and PRs listed above will be closed in favor of this one.

[bearyjd]

Another failure mode of the $SHELL -lc 'echo $PATH' prelude: it drains the hook's stdin on Linux (distrobox/toolbox), silently breaking memory capture

This is the Linux analogue of #2188 (Windows/WSL) and #2362 (darwin/zsh) — same "empty stdin → silent capture loss," different trigger — and it's caused by the same prelude this issue tracks.

Env: Fedora distrobox container, claude-mem 13.5.6, bash, Node hooks.

Root cause: the prelude runs $($SHELL -lc 'echo $PATH' 2>/dev/null) in command substitution, which shares fd 0 with the piped hook payload. bash -lc sources /etc/profile → /etc/profile.d/distrobox_profile.sh, and that script reads stdin during sourcing, consuming the JSON payload. By the time node bun-runner.js reads stdin it's empty:

[bun-runner] empty stdin payload received — issue #2188
  payload byte length: 0
  payload type: null (no data event or stream error)
  platform: linux
  shell: /usr/bin/bash

PostToolUse/observation capture then silently no-ops on every tool call. 2>/dev/null only redirects stderr; stdin is still shared, so the login shell (or anything its profile sources) can eat the payload.

Minimal repro (any environment whose login profile touches stdin — distrobox/toolbox distrobox_profile.sh is one):

printf 'PAYLOAD\n' | { _x="$($SHELL -lc 'echo $PATH' 2>/dev/null)"; cat; }
# prints nothing — the login shell ate the payload

printf 'PAYLOAD\n' | { _x="$($SHELL -lc 'echo $PATH' </dev/null 2>/dev/null)"; cat; }
# prints PAYLOAD — fixed

Confirmed against the real hook: piping a valid PostToolUse payload into the registered ... hook claude-code observation command reports payload byte length: 0 before, and reaches the worker after.

Minimal mitigation (verified): redirect the inner login shell's stdin so it can't inherit the payload:

- export PATH="$($SHELL -lc 'echo $PATH' 2>/dev/null):$PATH";
+ export PATH="$($SHELL -lc 'echo $PATH' </dev/null 2>/dev/null):$PATH";

The #2715 fix (use the injected PATH, fall back to a login shell only when PATH is empty — à la CODEX_CLI_PATH_PRELUDE) also resolves this, since it stops spawning the login shell in the common case. Either way, the PATH-probe subshell should never inherit the hook payload on fd 0 — recommend folding </dev/null (or the no-spawn approach) into the fix tracked here so the claude-code prelude in src/build/hook-shell-template.ts is hardened for non-Windows hosts too.